🐛 COMMON VULNERABILITIES AND EXPOSURES 9[−]
29 Nov KEVGoTitan Botnet Spotted Exploiting Recent Apache ActiveMQ VulnerabilityThe recently disclosed critical security flaw impacting Apache ActiveMQ is being actively exploited by threat actors to distribute a new Go-based botnet called GoTitan as well as a .NET program known as PrCtrl Rat that's capable of remotely commandeering the infected hosts. The a…THEHACKERNEWS.COM
29 NovZero-Day Alert: Google Chrome Under Active Attack, Exploiting New VulnerabilityGoogle has rolled out security updates to fix seven security issues in its Chrome browser, including a zero-day that has come under active exploitation in the wild. Tracked as CVE-2023-6345, the high-severity vulnerability has been described as an integer overflow bug in Skia, an…THEHACKERNEWS.COM
29 Nov KEVChrome Zero-Day Vulnerability That Exploited In The WildGoogle has fixed the sixth Chrome zero-day bug that was exploited in the wild this year. The flaw, identified as CVE-2023-6345, is classified as an integer overflow in Skia, an open-source 2D graphics library written in C++. “Google is aware that an exploit for CVE…GBHACKERS.COM
29 NovChromium: CVE-2023-6345 Integer overflow in SkiaThis CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see [Google Chrome Releases](https://chromereleases.googleblog.com/2023) for more information. Google is aware that an exploit for CVE-2023-6345 exists in…MSRC.MICROSOFT.COM
29 NovChromium: CVE-2023-6346 Use after free in WebAudioThis CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see [Google Chrome Releases](https://chromereleases.googleblog.com/2023) for more information.MSRC.MICROSOFT.COM
29 NovChromium: CVE-2023-6347 Use after free in MojoThis CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see [Google Chrome Releases](https://chromereleases.googleblog.com/2023) for more information.MSRC.MICROSOFT.COM
29 NovChromium: CVE-2023-6348 Type Confusion in SpellcheckThis CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see [Google Chrome Releases](https://chromereleases.googleblog.com/2023) for more information.MSRC.MICROSOFT.COM
29 NovChromium: CVE-2023-6350 Out of bounds memory access in libavifThis CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see [Google Chrome Releases](https://chromereleases.googleblog.com/2023) for more information.MSRC.MICROSOFT.COM
29 NovChromium: CVE-2023-6351 Use after free in libavifThis CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see [Google Chrome Releases](https://chromereleases.googleblog.com/2023) for more information.MSRC.MICROSOFT.COM
⚠️ VULNERABILITY DISCLOSURE 24[−]
29 NovNew RCE popchain in WordPresssubmitted by L4s to secops 1 points | 0 comments https://fenrisk.com/publications/blogpost/2023/11/22/gadgets-chain-in-wordpress/ New RCE popchain in WordPress::FenriskFENRISK.COM
29 NovSerial ‘SIM Swapper’ Sentenced to Eight Years in PrisonIn a digital age marred by deceit, 25-year-old Amir Hossein Golshan stands as a testament to the dark underbelly of cyberspace. Hailing from downtown Los Angeles, Golshan’s intricate orchestration of fraudulent schemes has earned him a federal prison sentence of 96 mo…GBHACKERS.COM
29 NovOkta Discloses Broader Impact Linked to October 2023 Support System BreachIdentity services provider Okta has disclosed that it detected "additional threat actor activity" in connection with the October 2023 breach of its support case management system. "The threat actor downloaded the names and email addresses of all Okta customer support system users…THEHACKERNEWS.COM
29 Nov3 ways to fix old, unsafe code that lingers from open-source and legacy programsCompanies that find themselves with old, vulnerable code in their environment are likely to be short of resources to fix them. Most organizations will find themselves in this situation at some point, whether it’s because they are using open-source programs or outdated ones. But t…CSOONLINE.COM
29 NovVulnerability in crypto wallets created online in the early 2010s | Kaspersky official blogHow an error in a key-generation algorithm left crypto wallets created online in 2011–2015 vulnerable to hacking.KASPERSKY.COM
29 NovZero-Day Alert: Google Chrome Under Active Attack, Exploiting New VulnerabilityUsers are recommended to upgrade to Chrome version 119.0.6045.199/.200 for Windows and 119.0.6045.199 for macOS and Linux to mitigate potential threats. Users of Chromium-based browsers are also advised to apply the fixes.THEHACKERNEWS.COM
29 NovNew BLUFFS Attack Lets Attackers Hijack Bluetooth ConnectionsConsidering the widespread use of the well-established wireless communication standard and the versions impacted by the exploits, BLUFFS could work against billions of devices, including laptops, smartphones, and other mobile devices.BLEEPINGCOMPUTER.COM
29 NovBreaking Laptop Fingerprint SensorsThey’re not that good : Security researchers Jesse D’Aguanno and Timo Teräs write that, with varying degrees of reverse-engineering and using some external hardware, they were able to fool the Goodix fingerprint sensor in a Dell Inspiron 15, the Synaptic sensor in a L…SCHNEIER.COM
29 NovHexacon 2023 Paris - 15 talkssubmitted by ashar to security_cpe 1 points | 0 comments https://infosec.pub/pictrs/image/b3fd1f5c-0f21-4bc5-b921-324d1aad39f5.png Hexacon 2023 Playlist Hexacon 2023 speakers and talks from the website Security Conference in PAris with all talks in English. “French people need to…INFOSEC.PUB
29 NovIranian Hackers Exploit PLCs in Attack on Water Authority in U.S.The U.S. Cybersecurity and Infrastructure Security Agency (CISA) revealed that it's responding to a cyber attack that involved the active exploitation of Unitronics programmable logic controllers (PLCs) to target the Municipal Water Authority of Aliquippa in western Pennsylvania.…THEHACKERNEWS.COM
29 Nov KEVFBI probes into Pennsylvanian water utility hack by pro-Iran groupMunicipal Water Authority of Aliquippa (MWAA), a water utility in the state of Pennsylvania, has entered a Federal and state investigation after a breach in one of its equipment by pro-Iran hacking group Cyber Av3ngers. On Friday, the attackers breached a piece of Israeli-made eq…CSOONLINE.COM
29 NovCISA Warns of Unitronics PLC Exploitation Following Water Utility HackAfter hackers compromised ICS at a US water utility, CISA issued a warning over the exploitation of the targeted Unitronics PLC. The post CISA Warns of Unitronics PLC Exploitation Following Water Utility Hack appeared first on SecurityWeek .SECURITYWEEK.COM
29 NovGoogle Patches Seventh Chrome Zero-Day of 2023The latest Chrome security update addresses the seventh exploited zero-day vulnerability documented in the browser in 2023. The post Google Patches Seventh Chrome Zero-Day of 2023 appeared first on SecurityWeek .SECURITYWEEK.COM
29 NovCISA Releases First Secure by Design AlertToday, CISA published guidance on How Software Manufacturers Can Shield Web Management Interfaces From Malicious Cyber Activity as a part of a new Secure by Design (SbD) Alert series. This SbD Alert urges software manufacturers to proactively prevent the exploitation of vulnerabi…CISA.GOV
29 NovHacker claims theft of Shadowfax users’ informationA hacker claims to be selling millions of user records relating to Indian startup Shadowfax, which offers logistics services to e-commerce and hyperlocal platforms across the country. The pseudonymous hacker said in a listing on a known cybercrime forum that they are selling the …TECHCRUNCH.COM
29 NovAttackers Actively Target Critical ownCloud VulnerabilityContent Collaboration Platform Sent Updates and Alert Directly to Users Last Month Security researchers say attackers are actively attempting to exploit a critical vulnerability in unpatched ownCloud implementations, which they can use to steal credentials and other secret inform…DATABREACHTODAY.CO.UK
29 NovFeds seize Sinbad crypto mixer allegedly used by North Korean hackersAs part of an international law enforcement investigation, the FBI and the Dutch Financial Intelligence and Investigation Service have seized the websites of a crypto mixer that was allegedly used by North Korean hackers and several cybercriminals to launder stolen funds and obfu…TECHCRUNCH.COM
29 NovPoCs for Critical Arcserve UDP Vulnerabilities ReleasedArcserve UDP is a popular enterprise data protection, backup and disaster recovery solution. The flaws were unearthed by Tenable researchers and privately disclosed to Arcserve in late August 2023.HELPNETSECURITY.COM
29 NovOkta: Breach Affected All Customer Support UsersWhen KrebsOnSecurity broke the news on Oct. 20, 2023 that identity and authentication giant Okta had suffered a breach in its customer support department, Okta said the intrusion allowed hackers to steal sensitive data from fewer than one percent of its 18,000+ customers. But tod…KREBSONSECURITY.COM
29 NovAlmost all developers are using AI despite security concerns, survey suggestsWhile more than half of developers acknowledge that generative AI tools commonly create insecure code, 96% of development teams are using the tools anyway, with more than half using the tools all the time, according to a report released Tuesday by Snyk, maker of a developer-first…CSOONLINE.COM
29 NovAmazon debuts biometric security device, updates Detective and GuardDutyThe latest security announcements from Amazon aim to address a wide range of security issues for businesses, including an all-in-one hand-scanning biometric system and new capabilities for its Detective security visualization tool and GuardDuty continuous monitoring solution. Ama…CSOONLINE.COM
29 NovUS House Members Eye Potential Regulations in Healthcare AIIndustry Experts Share Concerns Over Misuse, Privacy and Security With Committee As Congress weighs potential legislative and regulatory guardrails for the use of AI in healthcare, issues such as human oversight, privacy and security risk need close attention, said healthcare ind…DATABREACHTODAY.CO.UK
29 NovImproving Text Classification Resilience and Efficiency with RETVecElie Bursztein, Cybersecurity & AI Research Director, and Marina Zhang, Software Engineer Systems such as Gmail, YouTube and Google Play rely on text classification models to identify harmful content including phishing attacks, inappropriate comments, and scams. These types o…SECURITY.GOOGLEBLOG.COM
📢 SECURITY ADVISORIES 12[−]
29 NovCISA Announces Secure by Design Alert Series: How Vendor Decisions Can Reduce Harm at a Global ScaleCISA.GOV
29 NovNews alert: Kiteworks forecast lays out risk predictions, strategies for sensitive content in 2024San Mateo, Calif., November 29, 2023 – Kiteworks , which delivers data privacy and compliance for sensitive content communications through its Private Content Network (PCN), released today its Sensitive Content Communications 2024 Forecast Report . The report outlines 12 predicti…LASTWATCHDOG.COM
29 NovHackers breach US water facility via exposed Unitronics PLCsCISA (Cybersecurity & Infrastructure Security Agency) is warning that threat actors breached a U.S. water facility by hacking into Unitronics programmable logic controllers (PLCs) exposed online. [...]BLEEPINGCOMPUTER.COM
29 NovCISA Office of Bombing Prevention Recognizes Critical Infrastructure Security and Resilience MonthIn recognition of Critical Infrastructure Security and Resilience Month, CISA's Office of Bombing Prevention is engaging with stakeholders nationwide on the impact of bombing incidents and threats to critical infrastructure.CISA.GOV
29 NovBlueVoyant Raises $140M, Buys Resilience Firm Conquest CyberDeal Will Expand BlueVoyant's Footprint in US Government, Defense Industrial Base BlueVoyant purchased a risk management vendor led by an Army veteran to expand its SaaS footprint with U.S. government and defense industrial organizations. Buying Conquest Cyber will allow BlueVoya…DATABREACHTODAY.CO.UK
🔥 INCIDENT REPORTING 28[−]
29 NovDJVU Ransomware's Latest Variant 'Xaro' Disguised as Cracked SoftwareA variant of a ransomware strain known as DJVU has been observed to be distributed in the form of cracked software. "While this attack pattern is not new, incidents involving a DJVU variant that appends the .xaro extension to affected files and demanding ransom for a decryptor ha…THEHACKERNEWS.COM
29 NovBleach Anime Forum - 143,711 breached accountsIn 2015, the now defunct independent forum for the Bleach Anime series suffered a data breach that exposed 144k user records. The impacted data included usernames, email addresses and salted MD5 password hashes.HAVEIBEENPWNED.COM
29 NovCyber Security Today, Nov. 29, 2023 - More ransomware attacks on the healthcare sectorThis episode reports on a company hit twice by a ransomware gang, the arrest in Ukraine of the alleged head of a ransomware gang, and moreCYBERSECURITYTODAY.LIBSYN.COM
29 NovGoogle Workspace’s Design Flaw Allows Attacker Unauthorized AccessRecent years saw a surge in cloud tech adoption, highlighting the efficiency through tools like Google’s Domain-Wide Delegation. It enables GCP (Google Cloud Platform) identities to perform tasks in GWS (Google Workspace) apps on behalf of Workspace users, streamlinin…GBHACKERS.COM
29 NovUpdate: DP World Confirms Data Stolen in Cyberattack, No Ransomware UsedDP World Australia's investigation has confirmed that the incident was confined to the Australian operations and did not impact any other markets where DP World operates.BLEEPINGCOMPUTER.COM
29 NovRansomware attack disrupts multiple US hospital ERsArdent unable to confirm extent of compromised patient health or financial dataCSHUB.COM
29 NovOkta Says Hacker Stole Every Customer Support User's DetailsBeware Phishing and Social Engineering Attacks Targeting Passwords, Vendor Warns Identity and authentication giant Okta said the attacker behind its September data breach stole usernames and contact details for all users of its primary customer support system, and warned customer…DATABREACHTODAY.CO.UK
29 NovDJVU Ransomware's Latest Variant 'Xaro' Disguised as Cracked SoftwareDJVU, in itself a variant of the STOP ransomware, typically arrives on the scene masquerading as legitimate services or applications. It's also delivered as a payload of SmokeLoader.THEHACKERNEWS.COM
29 NovUpdate: Okta Discloses Broader Impact Linked to October 2023 BreachThe company also told the publication that while it does not have any evidence of the stolen information being actively misused, it has taken the step of notifying all customers of potential phishing and social engineering risks.THEHACKERNEWS.COM
29 NovJapan's Space Agency Suffers Cyber Attack, Points Finger At Active DirectoryPACKETSTORMSECURITY.COM
29 NovOkta Says Hackers Stole Data For All Customer Support Users In Cyber BreachPACKETSTORMSECURITY.COM
29 NovOkta: October data breach affects all customer support system usersOkta's investigation into the breach of its Help Center environment last month revealed that the hackers obtained data belonging to all customer support system users. [...]BLEEPINGCOMPUTER.COM
29 NovPlay Ransomware Group Lists 17 Victims, 14 US-Based Companies NamedExperts in security believe the Play ransomware group has ties to Russia. PlayCrypt is another name for the group. It was created by a team known as Balloonfly, which Symantec monitors.THECYBEREXPRESS.COM
29 NovStopping Cloud Workload AttacksIn this episode of "Cybersecurity Insights," Eyal Fisher discussed Sweet Security's Cloud Runtime Security Suite, which helps CISOS and security teams defend against all stages of a cyberattack by gathering data, generating insights, baselining the normal environment and looking …DATABREACHTODAY.CO.UK
29 NovOkta admits hackers accessed data on all customers during recent breachU.S. access and identity management giant Okta says hackers stole data about all of its customers during a recent breach of its support systems, despite previously stating that only a fraction of customers were affected. Okta confirmed in October that a hacker used a stolen crede…TECHCRUNCH.COM
29 NovWhat cybersecurity pros can learn from first respondersThough they may initially seem very different, there are some compelling similarities between cybersecurity professionals and traditional first responders like police and EMTs. After all, in a world where a cyberattack on critical infrastructure could cause untold damage and harm…SECURITYINTELLIGENCE.COM
29 NovJapan’s Space Agency Suffers Cyber AttackJAXA got to know about the attack after an external organization conducted an internal audit. A detailed investigation is going on into the hacking attempt and it was not revealed who could be orchestrating this.THEREGISTER.COM
29 NovBritish Library confirms customer data was stolen by hackers, with outage expected to last ‘months’The British Library has told customers that their personal data may have been stolen during a recent ransomware attack that knocked the library’s systems and website offline for the past month. In a notice sent to customers this week, which TechCrunch has seen, the British …TECHCRUNCH.COM
29 NovOkta Broadens Scope of Data Breach: All Customer Support Users AffectedOkta expands scope of October breach, saying hackers stole names and email addresses of all its customer support system users. The post Okta Broadens Scope of Data Breach: All Customer Support Users Affected appeared first on SecurityWeek .SECURITYWEEK.COM
29 NovNo One Knows How Online Pharmacy Company was Hit with a Data Breach Impacting 2.3 Million CustomersThis is a cautionary tale of both how your data can legally end up in the hands of an organization you never intended and how victims can be largely left in the dark post-breach.KNOWBE4.COM
29 NovJapanese Space Agency JAXA hacked in summer cyberattackThe Japan Aerospace Exploration Agency (JAXA) was hacked in a cyberattack over the summer, potentially compromising sensitive space-related technology and data. [...]BLEEPINGCOMPUTER.COM
29 NovQilin Ransomware Claims Attack on Automotive Giant YanfengThe threat actors published multiple samples to prove their alleged access to Yanfeng systems and files, including financial documents, non-disclosure agreements, quotation files, technical data sheets, and internal reports.BLEEPINGCOMPUTER.COM
29 NovBlack Basta ransomware made over $100 million from extortionRussia-linked ransomware gang Black Basta has raked in at least $100 million in ransom payments from more than 90 victims since it first surfaced in April 2022, according to joint research from Corvus Insurance and Elliptic. [...]BLEEPINGCOMPUTER.COM
29 NovEgyptian E-Payment Vendor Recovering From LockBit Ransomware AttackFawry remains confident that this data will not impact financial transactions on its platform, but the company believes it may have included the personal details of some customers whose information had been on the testing platform.DARKREADING.COM
29 NovDollar Tree hit by third-party data breach impacting 2 million customersDiscount store chain Dollar Tree was impacted by a third-party data breach affecting 1,977,486 customers after the hack of service provider Zeroed-In Technologies. [...]BLEEPINGCOMPUTER.COM
29 NovEstante Virtual - 5,412,603 breached accountsIn February 2019, the Brazilian book store Estante Virtual suffered a data breach that impacted 5.4M customers . The exposed data included names, usernames, email and physical addresses, phone numbers, dates of birth and unsalted SHA-1 password hashes.HAVEIBEENPWNED.COM
29 NovDollar Tree hit by third-party data breach impacting 2 million peopleDiscount store chain Dollar Tree was impacted by a third-party data breach affecting 1,977,486 people after the hack of service provider Zeroed-In Technologies. [...]BLEEPINGCOMPUTER.COM
🕵️ THREAT INTELLIGENCE 19[−]
29 NovDecoding the Patterns: Analyzing DShield Honeypot Activity [Guest Diary], (Mon, Nov 27th)[This is a Guest Diary by Alex Rodriguez, an ISC intern as part of the SANS.edu BACS program]
ISC.SANS.EDU
29 NovISC Stormcast For Wednesday, November 29th, 2023 https://isc.sans.edu/podcastdetail/8756, (Wed, Nov 29th)(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.ISC.SANS.EDU
29 Nov200+ Malicious Apps on Iranian Android Store Installed by Millions of Banking UsersAn Android malware campaign targeting Iranian banks has expanded its capabilities and incorporated additional evasion tactics to fly under the radar. That's according to a new report from Zimperium, which discovered more than 200 malicious apps associated with the malicious opera…THEHACKERNEWS.COM
29 NovGoogle Will Start Deleting ‘Inactive’ Accounts in December. Here’s What You Need to KnowThe easiest way to keep your Google account active (and thus prevent it from being deleted) is to sign in at least once every two years. The post Google Will Start Deleting ‘Inactive’ Accounts in December. Here’s What You Need to Know appeared first on SecurityWeek .SECURITYWEEK.COM
29 Nov[Live Demo] Ridiculously Easy Security Awareness Training and PhishingOld-school awareness training does not hack it anymore. Your email filters have an average 7-10% failure rate; you need a strong human firewall as your last line of defense.KNOWBE4.COM
29 NovBLUFFS: Six New Attacks that Break Secrecy of Bluetooth SessionsSix novel Bluetooth attack methods have been discovered, which were named BLUFFS (Bluetooth Forward and Future Secrecy) attacks. These attacks could enable threat actors to impersonate devices or machine-in-the-middle attacks. These attacks have been reported to be at the archite…GBHACKERS.COM
29 NovWhat are You Working on Wednesdaysubmitted by shellsharks to cybersecurity 1 points | 0 comments Weekly thread to discuss whatever you’re working on, big or small, at work or in your free time.INFOSEC.PUB
29 NovFive Cybersecurity Predictions for 2024Cybersecurity predictions for 2024 to help security professionals in prioritizing efforts to navigate the ever-changing threat landscape. The post Five Cybersecurity Predictions for 2024 appeared first on SecurityWeek .SECURITYWEEK.COM
29 NovPalo Alto Networks Paves the Way with New OT Security InnovationsZero Trust OT Security is built to provide visibility and security for OT assets and networks, 5G connected assets and remote operations. The post Palo Alto Networks Paves the Way with New OT Security Innovations appeared first on Palo Alto Networks Blog .PALOALTONETWORKS.COM
29 NovIranian Mobile Banking Malware Steal Login Credentials & Steal OTP CodesAn Android malware campaign was previously discovered that distributed banking trojans targeting four major Iranian Banks: Bank Mellat, Bank Saderat, Resalat Bank, and Central Bank of Iran. There were 40 credential-harvesting applications circulated on Cafe Bazaar between Decembe…GBHACKERS.COM
29 NovNew BLUFFS Bluetooth Attack Methods Can Have Large-Scale Impact: ResearcherAn academic researcher demonstrates BLUFFS, six novel attacks targeting Bluetooth sessions’ forward and future secrecy. The post New BLUFFS Bluetooth Attack Methods Can Have Large-Scale Impact: Researcher appeared first on SecurityWeek .SECURITYWEEK.COM
29 NovKeyless Goes Independent, Raises $6M for Biometric AuthenticationBritish startup building biometric authentication technology has snagged $6 million in a new round of funding led by Rialto Ventures. The post Keyless Goes Independent, Raises $6M for Biometric Authentication appeared first on SecurityWeek .SECURITYWEEK.COM
29 NovQR Code Phishing Campaigns on the RiseThere’s been a “precipitous rise” in QR code phishing campaigns in 2023, according to Matthew Tyson at CSO.KNOWBE4.COM
29 NovChatGPT Turns One - and the Future of Generative AIGartner's Avivah Litan on Impact of OpenAI Drama and State of Gen AI Nov. 30 marks the one-year public birthday of ChatGPT. Gartner's Avivah Litan shared insights on the current state and future of generative AI, as well as the potential market after-effects of the pre-Thanksgivi…DATABREACHTODAY.CO.UK
29 NovUS seizes Sinbad crypto mixer used by North Korean Lazarus hackersThe U.S. Department of the Treasury has sanctioned the Sinbad cryptocurrency mixing service for its use as a money-laundering tool by the North Korean Lazarus hacking group. [...]BLEEPINGCOMPUTER.COM
29 NovUS seizes Sinbad Crypto Mixer Used by North Korean Lazarus GroupSinbad has processed millions of dollars' worth of virtual currency from Lazarus Group heists, including the Horizon Bridge and Axie Infinity heists," reads a Department of Treasury press statement.BLEEPINGCOMPUTER.COM
29 NovUS Sanctions, Seizes Sinbad CryptomixerSinbad Was the 'Preferred Mixing Service' of North Korean Hackers The U.S. federal government Wednesday added cryptocurrency mixer Sinbad.io to a growing blacklist of virtual asset platforms under sanctions that prevent Americans from doing business with them. The FBI seized the …DATABREACHTODAY.CO.UK
29 NovDefending Against Supply Chain Attacks - Bri Rolston - BTS #18Bri has spent her career investigating and defending against critical infrastructure attacks. Hear her take on the current threat landscape, supply chain security, and more! This segment is sponsored by Eclypsium. Visit https://securityweekly.com/eclypsium to learn more about the…YOUTUBE.COM
29 NovExperts Urge Congress to Establish Clear SBOM GuidanceFederal Agencies Lack Comprehensive Guidelines For Developing SBOMs, Experts Say Procurement experts testified to the House subcommittee on cybersecurity, information technology and government innovation Wednesday that government requirements leave too many unanswered questions a…DATABREACHTODAY.CO.UK
🌐 CYBER THREAT LANDSCAPE 3[−]
29 NovMalware Analysis Report: Stealc StealerIt steals browsers' databases and attempts all Chromium-based browsers that share the same structure of databases and also will explore Mozilla-based web engines and “Thunderbird” mail client which is based on Mozilla.MSSPLAB.GITHUB.IO
29 NovUnveiling the Persisting Threat: Iranian Mobile Banking Malware Campaign Extends Its ReachThe primary goal of the bogus apps is to trick victims into granting them extensive permissions as well as harvest banking login credentials and credit card details by abusing Android's accessibility services.ZIMPERIUM.COM
29 NovFounder of spyware maker Hacking Team arrested for attempted murder: local mediaThe founder of the infamous and now-defunct spyware maker Hacking Team was arrested on Saturday after allegedly stabbing and attempting to murder a relative, according to multiple news reports. David Vincenzetti, who launched Hacking Team in 2003, was arrested when police showed …TECHCRUNCH.COM
📡 INFOSEC NEWS 12[−]
29 NovDiscover Why Proactive Web Security Outsmarts Traditional Antivirus SolutionsIn a rapidly evolving digital landscape, it's crucial to reevaluate how we secure web environments. Traditional antivirus-approach solutions have their merits, but they're reactive. A new report delves into the reasons for embracing proactive web security solutions, ensuring you …THEHACKERNEWS.COM
29 NovGoogle Cloud Environment Flaw Lets Attackers Access Critical Data, SystemsPACKETSTORMSECURITY.COM
29 NovA Fifth of UK SMBs Can’t Spot ScamsSMBs are an increasingly popular target as their bank accounts hold more money than the average consumer, but have few measures in place to prevent fraud, such as rigorous business processes and employee training.INFOSECURITY-MAGAZINE.COM
29 NovHow Continuous Pen Testing Protects Web Apps from Emerging ThreatsThe nature and ubiquity of modern web apps make them rife for targeting by hackers. Learn more from Outpost24 about the value of continuous monitoring to secure modern web apps. [...]BLEEPINGCOMPUTER.COM
29 NovWhy is cybersecurity venture funding so tepid despite the strong demand?Has late-stage investing declined so much that no technology subsector can really post impressive investment numbers? © 2023 TechCrunch. All rights reserved. For personal use only.TECHCRUNCH.COM
29 NovSIM swapper gets 8 years in prison for account hacks, crypto theftAmir Hossein Golshan, 25, was sentenced to eight years in prison by a Los Angeles District Court and ordered to pay $1.2 million in restitution for crimes involving SIM swapping, merchant fraud, support fraud, account hacking, and cryptocurrency theft. [...]BLEEPINGCOMPUTER.COM
29 NovMicrosoft starts testing new Windows 11 Energy Saver featureMicrosoft has started testing a new Windows 11 Energy Saver feature that helps customers extend their portable computers' battery life. [...]BLEEPINGCOMPUTER.COM
29 NovBlueVoyant Acquires Conquest Cyber to Help Clients Mitigate RisksBlueVoyant will integrate Conquest Cyber’s technology into its existing products and services to create the first solution to deliver comprehensive internal and external cyber defense mapped to risk maturity.HELPNETSECURITY.COM
29 NovBritish Afrobeat singer pleads guilty to stealing $6 million in hacks on financial accountsAccording to the Department of Justice, from 2011 until 2018 Mustapha and his unnamed co-conspirators siphoned funds from financial accounts whose login information they illegally accessed through phishing attacks.THERECORD.MEDIA
29 NovVery precisely lost – GPS jammingThe technology is both widely available and well developed, hence it's also poised to proliferate – especially in the hands of those wishing illWELIVESECURITY.COM